Overview

The BD Approver app is used to review and approve or reject the intents raised in your Institutional Vault. An intent is a policy-governed request, such as a transfer or a policy change, that requires approval before it can proceed.

When you onboard using the BD Approver app, the app generates a unique public/private key pair on your device. The private key stays protected on the device, in the Secure Enclave on iOS, the Android Keystore on Android, or a YubiKey on Windows. The public key is registered against your user identity in the Vault, so any approval you provide is cryptographically bound to your identity and provably yours.

When an intent needs your approval, the app shows it in clear text so you can see exactly what you are approving. You then approve or reject it. The app signs your decision with your private key, which never leaves your device, and sends the signed decision back to the Vault. The Vault's policy nodes each independently check the signature against your registered public key before acting on it, so every approval is cryptographically verifiable and you only ever sign what you have seen.

Your Vault can be configured to require a quorum for certain intents, meaning that several users must each approve the intent in their own BD Approver app before it can proceed. Each approver reviews the intent and signs their decision independently, with their own key.

Prerequisites

Your company's identity provider (for example Okta, Google, or another IDP your organization has configured), or credentials registered directly with Blockdaemon.
The BD Approver app:
- iOS — App Store
- Android — Google Play Store
- Windows desktop

📘
Finding the app
The BD Approver app is not searchable in the App Store or Google Play Store listings. When your organization onboards you, you will receive an invite with a QR code or link that takes you directly to the correct app listing.
The desktop app is not publicly released. Contact Blockdaemon for the Windows binary.

Step by Step

The steps below walk through pairing and onboarding the BD Approver app to your wallet environment. The interface and onboarding flow are the same across all three. The guide below covers onboarding on any of them, with notes where a step differs by device.

Select Pair new wallet in the BD Approver app.
Scan or paste the wallet pairing link. On mobile, scan the QR code shown in the Institutional Vault wallet UI in your browser. On desktop, copy the pairing link from the Institutional Vault wallet UI (Copy wallet pairing link), then paste it into the BD Approver app. This links the BD Approver app to your identity on this wallet environment, so it can be used to approve or reject policy-based operations.
Confirm the wallet environment and continue. The app will show you the wallet environment you are pairing with.
Choose your key storage. During pairing, a public/private key pair is generated and tied to your identity, so it needs to be stored somewhere that only you can access. Where the private key is stored depends on your device:
- iOS — stored in the Secure Enclave (the only option on iOS).
- Android — stored in the Android Keystore (the only option on Android).
- Windows desktop — stored on a hardware security key (YubiKey). See the YubiKey PIV Setup guide for details.
Enroll biometrics (mobile) or set a PIN (Windows desktop). This protects your signing key with an additional factor tied to you, in case your device is lost or accessed by someone else.
- iOS — enable Face ID.
- Android — enable biometrics.
- Windows desktop — set a PIN (biometrics are not available on Windows).
Authenticate using your organization's identity provider. This step will vary based on your organization's IDP configuration (for example Okta, Google, or another provider). The BD Approver app automatically follows whatever authentication method your organization has configured, so no separate setup is needed on your end.
Review and confirm your wallet details, including your name, email address, and the wallet environment you are onboarding to.
Once confirmed, you're fully onboarded and can begin approving wallet operations from the BD Approver app.

FAQs

Why do I need the BD Approver app instead of just approving in the wallet UI directly?

The BD Approver app lets you cryptographically sign your approval on a device tied to your own identity, after reviewing the operation in clear text. This provides a verifiable, cryptographically signed approval quorum for every operation.

Are my transactions signed on my device?

No. This is a common misconception. Your device cryptographically signs intents, your approval or rejection of an operation, not the underlying transaction itself. Transaction signing occurs on Blockdaemon's policy node infrastructure, not on your device.

What happens if I lose access to my BD Approver app (for example, I lose my phone)?

Have an administrator reset your user. You can then re-pair by installing the BD Approver app on your new device and repeating the onboarding steps above.

How do I move the BD Approver app to a new device?

Follow the same process as losing access: have an administrator reset your user, then re-pair on the new device.

Can I have the BD Approver app paired on multiple devices at once?

No. Only one BD Approver app can be paired to your user and environment at any one time.

How do I update the BD Approver app, and how do I know what version I'm on?

Your current app version is shown in the app under your profile (the icon in the top right). Updates are delivered via the App Store or Google Play Store for mobile. For Windows desktop, install the latest binary provided by Blockdaemon the same way you would update any other Windows application.

🗣️We Are Here to Help!

Please contact us via email or support chat if you encounter an issue, bug, or need assistance. Don't forget to include any relevant details about the problem. To request a wallet form and Institutional Vault Approver form, please click here or contact our sales team.